Re: [OAUTH-WG] draft-ietf-oauth-rar use of “WWW-Authenticate” Response Header

[Brian Campbell <[e-mail]>]

There are certainly similarities between authorization details and scope.
And yes, both are API-specific to some extent. But scope is generally more
coarse-grained while authorization details can have lots of, well, um, very
specific details relating deep into the API. So much so that expressing
those details at the layer of the “WWW-Authenticate” Response Header didn't
seem needed or necessarily appropriate. I realize that's probably not a
satisfying answer but is my understanding of the consensus behind what
ended up in the document. Also the scope param of the “WWW-Authenticate”
response header apparently isn't used a lot in practice so there wasn't a
lot of interest/focus to continue with the construct. Note also that the
document is in the late late stages of the RFC Editors' queue
https://www.rfc-editor.org/auth48/rfc9396 so well past the point of
accepting significant changes. You could, of course, propose new work to
the WG towards this end, if you feel strongly about it. But the RAR
document is basically frozen now.

Regards,
Brian





On Fri, May 26, 2023 at 2:14 AM Oliva Fernandez, Jorge
<Jorge.OlivaFernandez=[e-mail]> wrote:

> Thanks for the answer, Bryan!
>
>
>
> I’m not sure if I understand correctly, the authorization details are
> API-specific the same as the “scope” right? Let me know if I’m
> misinterpreting something but for me RAR is an evolution of the scope,
> because the scope parameter is not useful for complex authorization
> decision we introduce a new field, with a rich syntax to describe the
> operation that is going to be authorized, right? So, if OAuth define that
> the protected resource is able to indicate problems with the authorization
> bearer using the WWW-Authenticate Response Header Field, is not exactly the
> same case when a protected resource needs the rich authorization?
>
>
>
> Best regards.
>
>
>
> *From: *OAuth <[e-mail]> on behalf of Brian Campbell
> <bcampbell=[e-mail]>
> *Date: *Thursday, 25 May 2023 at 21:30
> *To: *"Oliva Fernandez, Jorge" <Jorge.OlivaFernandez=
> [e-mail]>
> *Cc: *"[e-mail]" <[e-mail]>
> *Subject: *[EXT]Re: [OAUTH-WG] draft-ietf-oauth-rar use of
> “WWW-Authenticate” Response Header
>
>
>
> *CAUTION:* This message is from an EXTERNAL sender – be vigilant,
> particularly with links and attachments. If you suspect it, report it
> immediately using the phishing button.
>
> The thinking was generally that params of WWW-Authenticate Response Header
> Field weren't a great fit for rich JSON authorization data (both in syntax
> and semantics).  The authorization detail types are really API-specific
> things, and as a result, it's expected that the methods by which clients
> obtain or generate the authorization details are also API-specific. Not
> sure that exactly answers the question but hopefully helps.
>
>
>
>
>
>
>
> On Thu, May 25, 2023 at 5:16 AM Oliva Fernandez, Jorge
> <Jorge.OlivaFernandez=[e-mail]> wrote:
>
> Hi,
>
>
>
> I have been reviewing the last RAR draft (
> https://datatracker.ietf.org/doc/html/draft-ietf-oauth-rar-23) and I was
> expecting to find some references about how to use the “WWW-Authenticate”
> Response Header Field defined in RFC6750 (
> https://datatracker.ietf.org/doc/html/rfc6750#section-3) in this document.
>
>
>
> I think that RAR is a great idea for complex authorization where a “scope”
> is not enough to describe what you want to authorize, in OAuth 2.0 there
> exist a way for a protected resource to indicate what “scopes” are need it
> to consider the request “authorized”, should not be an standard way to do
> the same for rich authorization request?
>
>
>
> Best regards.
>
> Emails aren't always secure, and they may be intercepted or changed after
> they've been sent. Santander doesn't accept liability if this happens. If
> you think someone may have interfered with this email, please get in touch
> with the sender another way. This message doesn't create or change any
> contract. Santander doesn't accept responsibility for damage caused by any
> viruses contained in this email or its attachments. Emails may be
> monitored. If you've received this email by mistake, please let the sender
> know at once that it's gone to the wrong person and then destroy it without
> copying, using, or telling anyone about its contents.
>
> Santander UK plc. Registered Office: 2 Triton Square, Regent's Place,
> London, NW1 3AN, United Kingdom. Registered Number 2294747. Registered in
> England and Wales. https://www.santander.co.uk. Telephone [phone].
> Calls may be recorded or monitored. Authorised by the Prudential Regulation
> Authority and regulated by the Financial Conduct Authority and the
> Prudential Regulation Authority. Our Financial Services Register number is
> 106054. You can check this on the Financial Services Register by visiting
> the FCA’s website https://www.fca.org.uk/register.  Santander and the
> flame logo are registered trademarks.
>
> Ref:[PDB#1-4B]
>
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
>
>
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited.
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*
> Emails aren't always secure, and they may be intercepted or changed after
> they've been sent. Santander doesn't accept liability if this happens. If
> you think someone may have interfered with this email, please get in touch
> with the sender another way. This message doesn't create or change any
> contract. Santander doesn't accept responsibility for damage caused by any
> viruses contained in this email or its attachments. Emails may be
> monitored. If you've received this email by mistake, please let the sender
> know at once that it's gone to the wrong person and then destroy it without
> copying, using, or telling anyone about its contents.
> Santander UK plc. Registered Office: 2 Triton Square, Regent's Place,
> London, NW1 3AN, United Kingdom. Registered Number 2294747. Registered in
> England and Wales. https://www.santander.co.uk. Telephone [phone].
> Calls may be recorded or monitored. Authorised by the Prudential Regulation
> Authority and regulated by the Financial Conduct Authority and the
> Prudential Regulation Authority. Our Financial Services Register number is
> 106054. You can check this on the Financial Services Register by visiting
> the FCA’s website https://www.fca.org.uk/register.  Santander and the
> flame logo are registered trademarks.
>
> Ref:[PDB#1-4B]
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._